{"id":"https://openalex.org/W3043486047","doi":"https://doi.org/10.1109/cybersecurity49315.2020.9138871","title":"Evaluation of Machine Learning Algorithms for Anomaly Detection","display_name":"Evaluation of Machine Learning Algorithms for Anomaly Detection","publication_year":2020,"publication_date":"2020-06-01","ids":{"openalex":"https://openalex.org/W3043486047","doi":"https://doi.org/10.1109/cybersecurity49315.2020.9138871","mag":"3043486047"},"language":"en","primary_location":{"id":"doi:10.1109/cybersecurity49315.2020.9138871","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cybersecurity49315.2020.9138871","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://researchonline.gcu.ac.uk/ws/files/41153132/Elmrabit_N._et_al_2020_Evaluation_of_machine_learning_algorithms_for_anomaly_detection.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5005271596","display_name":"Nebrase Elmrabit","orcid":"https://orcid.org/0000-0002-4267-8798"},"institutions":[{"id":"https://openalex.org/I195939026","display_name":"Glasgow Caledonian University","ror":"https://ror.org/03dvm1235","country_code":"GB","type":"education","lineage":["https://openalex.org/I195939026"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Nebrase Elmrabit","raw_affiliation_strings":["Department of Cyber Security, Glasgow Caledonian University, Glasgow, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Cyber Security, Glasgow Caledonian University, Glasgow, UK","institution_ids":["https://openalex.org/I195939026"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025874707","display_name":"Feixiang Zhou","orcid":"https://orcid.org/0000-0003-4939-9393"},"institutions":[{"id":"https://openalex.org/I153648349","display_name":"University of Leicester","ror":"https://ror.org/04h699437","country_code":"GB","type":"education","lineage":["https://openalex.org/I153648349"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Feixiang Zhou","raw_affiliation_strings":["School of Informatics, University of Leicester, Leicester, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Informatics, University of Leicester, Leicester, UK","institution_ids":["https://openalex.org/I153648349"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5018981098","display_name":"Fengyin Li","orcid":"https://orcid.org/0000-0002-5730-3315"},"institutions":[{"id":"https://openalex.org/I202126657","display_name":"Qufu Normal University","ror":"https://ror.org/03ceheh96","country_code":"CN","type":"education","lineage":["https://openalex.org/I202126657"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fengyin Li","raw_affiliation_strings":["School of Information Science, Qufu Normal University, Rizhao, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Information Science, Qufu Normal University, Rizhao, China","institution_ids":["https://openalex.org/I202126657"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5066119228","display_name":"Huiyu Zhou","orcid":"https://orcid.org/0000-0003-1634-9840"},"institutions":[{"id":"https://openalex.org/I153648349","display_name":"University of Leicester","ror":"https://ror.org/04h699437","country_code":"GB","type":"education","lineage":["https://openalex.org/I153648349"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Huiyu Zhou","raw_affiliation_strings":["School of Informatics, University of Leicester, Leicester, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Informatics, University of Leicester, Leicester, UK","institution_ids":["https://openalex.org/I153648349"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5005271596"],"corresponding_institution_ids":["https://openalex.org/I195939026"],"apc_list":null,"apc_paid":null,"fwci":12.6375,"has_fulltext":true,"cited_by_count":190,"citation_normalized_percentile":{"value":0.98916236,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7892364263534546},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.6551498770713806},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.6433354020118713},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.6210858821868896},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5794910192489624},{"id":"https://openalex.org/keywords/precision-and-recall","display_name":"Precision and recall","score":0.5344549417495728},{"id":"https://openalex.org/keywords/receiver-operating-characteristic","display_name":"Receiver operating characteristic","score":0.494412899017334},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4765123426914215},{"id":"https://openalex.org/keywords/statistical-classification","display_name":"Statistical classification","score":0.4554235339164734},{"id":"https://openalex.org/keywords/decision-tree","display_name":"Decision tree","score":0.4441814422607422},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4109508991241455}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7892364263534546},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.6551498770713806},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.6433354020118713},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.6210858821868896},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5794910192489624},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.5344549417495728},{"id":"https://openalex.org/C58471807","wikidata":"https://www.wikidata.org/wiki/Q327120","display_name":"Receiver operating characteristic","level":2,"score":0.494412899017334},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4765123426914215},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.4554235339164734},{"id":"https://openalex.org/C84525736","wikidata":"https://www.wikidata.org/wiki/Q831366","display_name":"Decision tree","level":2,"score":0.4441814422607422},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4109508991241455}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1109/cybersecurity49315.2020.9138871","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cybersecurity49315.2020.9138871","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)","raw_type":"proceedings-article"},{"id":"pmh:oai:researchonline.gcu.ac.uk:publications/cd2e3efc-769f-4f8b-845d-01593eeb8ad8","is_oa":true,"landing_page_url":"https://researchonline.gcu.ac.uk/en/publications/cd2e3efc-769f-4f8b-845d-01593eeb8ad8","pdf_url":"https://researchonline.gcu.ac.uk/ws/files/41153132/Elmrabit_N._et_al_2020_Evaluation_of_machine_learning_algorithms_for_anomaly_detection.pdf","source":{"id":"https://openalex.org/S7407055385","display_name":"ResearchOnline","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Elmrabit, N, Zhou, F, Li, F & Zhou, H 2020, Evaluation of machine learning algorithms for anomaly detection. in 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)., 9138871, IEEE, International Conference on Cyber Security and Protection of Digital Services, 15/06/20. https://doi.org/10.1109/CyberSecurity49315.2020.9138871","raw_type":"info:eu-repo/semantics/conferenceObject"},{"id":"pmh:oai:figshare.com:article/12316898","is_oa":true,"landing_page_url":"https://figshare.com/articles/conference_contribution/Evaluation_of_Machine_Learning_Algorithms_for_Anomaly_Detection/12316898","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Text"},{"id":"pmh:oai:zenodo.org:5137264","is_oa":true,"landing_page_url":"https://doi.org/10.1109/CyberSecurity49315.2020.9138871","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"info:eu-repo/semantics/conferencePaper"}],"best_oa_location":{"id":"pmh:oai:researchonline.gcu.ac.uk:publications/cd2e3efc-769f-4f8b-845d-01593eeb8ad8","is_oa":true,"landing_page_url":"https://researchonline.gcu.ac.uk/en/publications/cd2e3efc-769f-4f8b-845d-01593eeb8ad8","pdf_url":"https://researchonline.gcu.ac.uk/ws/files/41153132/Elmrabit_N._et_al_2020_Evaluation_of_machine_learning_algorithms_for_anomaly_detection.pdf","source":{"id":"https://openalex.org/S7407055385","display_name":"ResearchOnline","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Elmrabit, N, Zhou, F, Li, F & Zhou, H 2020, Evaluation of machine learning algorithms for anomaly detection. in 2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)., 9138871, IEEE, International Conference on Cyber Security and Protection of Digital Services, 15/06/20. https://doi.org/10.1109/CyberSecurity49315.2020.9138871","raw_type":"info:eu-repo/semantics/conferenceObject"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3043486047.pdf","grobid_xml":"https://content.openalex.org/works/W3043486047.grobid-xml"},"referenced_works_count":33,"referenced_works":["https://openalex.org/W858436891","https://openalex.org/W1498436455","https://openalex.org/W2064675550","https://openalex.org/W2099940443","https://openalex.org/W2106393550","https://openalex.org/W2112076978","https://openalex.org/W2144354855","https://openalex.org/W2147169507","https://openalex.org/W2149706766","https://openalex.org/W2157331557","https://openalex.org/W2296509296","https://openalex.org/W2743606042","https://openalex.org/W2783796368","https://openalex.org/W2789828921","https://openalex.org/W2793412195","https://openalex.org/W2897623414","https://openalex.org/W2904188281","https://openalex.org/W2905199997","https://openalex.org/W2907421153","https://openalex.org/W2911964244","https://openalex.org/W2921708219","https://openalex.org/W2924689635","https://openalex.org/W2926701059","https://openalex.org/W2944643572","https://openalex.org/W2945522736","https://openalex.org/W2959392253","https://openalex.org/W2962621836","https://openalex.org/W2963929932","https://openalex.org/W3214373139","https://openalex.org/W4236137412","https://openalex.org/W4244238212","https://openalex.org/W6676769703","https://openalex.org/W6803782233"],"related_works":["https://openalex.org/W4366990902","https://openalex.org/W4317732970","https://openalex.org/W4388550696","https://openalex.org/W4313289487","https://openalex.org/W4321636153","https://openalex.org/W4385192698","https://openalex.org/W4224262160","https://openalex.org/W2034680797","https://openalex.org/W4207040723","https://openalex.org/W2967426019"],"abstract_inverted_index":{"Malicious":[0],"attack":[1],"detection":[2],"is":[3,52,72,96,130],"one":[4],"of":[5,39,83,92,114],"the":[6,11,18,47,62,75,81,93,103,109,143,153,157],"critical":[7],"cyber-security":[8],"challenges":[9],"in":[10,37,112],"peer-to-peer":[12],"smart":[13],"grid":[14],"platforms":[15],"due":[16],"to":[17,42,139,149],"fact":[19],"that":[20,102,134,142],"attackers'":[21],"behaviours":[22,45],"change":[23],"continuously":[24],"over":[25,46],"time.":[26],"In":[27],"this":[28],"paper,":[29],"we":[30],"evaluate":[31],"twelve":[32],"Machine":[33],"Learning":[34],"(ML)":[35],"algorithms":[36,95,136],"terms":[38,113],"their":[40],"ability":[41],"detect":[43],"anomalous":[44],"networking":[48],"practice.":[49],"The":[50,69,98],"evaluation":[51,99],"performed":[53,73],"on":[54,86,125,152],"three":[55],"publicly":[56],"available":[57],"datasets:":[58],"CICIDS-2017,":[59],"UNSW-NB15":[60],"and":[61,119,141],"Industrial":[63],"Control":[64],"System":[65],"(ICS)":[66],"cyber-attack":[67],"datasets.":[68,128],"experimental":[70],"work":[71],"through":[74],"ALICE":[76],"high-performance":[77],"computing":[78],"facility":[79],"at":[80],"University":[82],"Leicester.":[84],"Based":[85],"these":[87,127],"experiments,":[88],"a":[89],"comprehensive":[90],"analysis":[91],"ML":[94,147],"presented.":[97],"results":[100],"verify":[101],"Random":[104],"Forest":[105],"(RF)":[106],"algorithm":[107,148],"achieves":[108],"best":[110],"performance":[111],"accuracy,":[115],"precision,":[116],"Recall,":[117],"F1-Score":[118],"Receiver":[120],"Operating":[121],"Characteristic":[122],"(ROC)":[123],"curves":[124],"all":[126],"It":[129],"worth":[131],"pointing":[132],"out":[133],"other":[135],"perform":[137],"closely":[138],"RF":[140],"decision":[144],"regarding":[145],"which":[146],"select":[150],"depends":[151],"data":[154],"produced":[155],"by":[156],"application":[158],"system.":[159]},"counts_by_year":[{"year":2026,"cited_by_count":12},{"year":2025,"cited_by_count":43},{"year":2024,"cited_by_count":57},{"year":2023,"cited_by_count":31},{"year":2022,"cited_by_count":33},{"year":2021,"cited_by_count":13},{"year":2020,"cited_by_count":1}],"updated_date":"2026-06-03T09:05:47.796612","created_date":"2025-10-10T00:00:00"}